The present invention relates to a method and a corresponding apparatus for safe single-channel evaluation of sensor signals, in particular transmitter signals.
Conventionally, safe sensor evaluation is ensured by multiple redundancy, namely a redundant signal production stage, a redundant evaluation stage and a redundant data transmission stage. In this context, the sensor signals are conditioned by redundant evaluation stages and are forwarded by means of likewise redundant data transfer elements via two separate and hence likewise redundant data lines to a superordinate processing unit. There, the sensor information is conditioned by means of separate evaluation devices, the conditioning results being able to be compared with one another and separate turn-off paths being able to be used to turn off safety-relevant actuators. The multiple redundancy, however; necssitates an increased hardware complexity and, corresponding increased costs for safe sensor evaluation.
It is therefore an object of the present invention to make it possible for sensors used for position detection, for example, to have the signals evaluated and processed further within a hardware module (e.g. an ASIC or microcontroller) and then made available to a superordinate processing device over a data link, with safe sensor evaluation being possible despite single-channel processing by an integrated module.
In accordance with the present invention, the aforesaid object is achieved by a method for safe evaluation of sensor signals having the following successive method steps:
the sensor signals are diversified by deriving a redundancy signal at an arbitrary point in a hitherto redundant signal processing chain directly from the original sensor signal in accordance with prescribed processing instructions, namely:
original signal and redundancy signal are digitized;
the digital original signal and redundancy signal are converted into a single-channel signal for singular further processing;
this single-channel signal is transmitted on a single channel to a superordinate processing unit;
dual-channel signal results are derived in the superordinate processing unit by reversing the prescribed processing instruction; and
original signal and redundancy signal are monitored for plausibility by reciprocal signal result comparison.
This suitable interconnection of the sensor signals permits safe sensor evaluation with a minimum of hardware complexity as a result of quasi-redundancy, and this can also take place within a hardware module. In a preferred embodiment, the redundancy is produced at the foremost point in the signal processing chain when the sensor signals are generated. The redundant single-channel nature produced in this manner permits singular further processing.
On the basis of the diversification of signals in accordance with a known algorithm, for which a person skilled in the art has a large number to choose from, safety-conforming single-channel data processing and data transmission are ensured by virtue of a downstream processing device deriving dual-channel signals therefrom, by reversing the algorithm, and evaluating them.
One advantageous processing algorithm for the method in accordance with the present invention is implemented by deriving a redundancy signal from the original sensor signal by forming the sum and the difference from the signal pair of the original signal as a processing instruction, so that said sum and difference form the signal pair of the redundancy signal.
In accordance with a refinement of the method according to the present invention, it is also possible for just one converter to be required for digitizing the two sensor signals. This reduces the hardware complexity further and this is achieved by the following further method step:
the two sensor signals are digitized by an analog/digital converter using time-division multiplexing by using a changeover switch to alternately route the original signal and the redundancy signal to the analog/digital converter.
In accordance with another preferred refinement of the method according to the present invention, the following further method steps achieve the safety-relevant function by using just one digitization device and a data processing and transmission device:
the digitized original signal and redundancy signal are transmitted on a single channel to two separate evaluation units arranged in the superordinate processing unit;
the associated digitized signal is checked for plausibility by calculating the respective signal result in each evaluation unit; and
the signal results of the two evaluation units are compared in the superordinate processing unit.
In accordance with yet another preferred refinement of the method according to the present invention, an error-tolerant transmission protocol is used for the data packet for at least one digitized signal during single-channel transmission to the superordinate processing unit.
In accordance with another alternative refinement of the method according to the present invention, the safety-relevant function is achieved by the following further method steps:
one of the two digitized signals is evaluated in the sensor and a first signal result is calculated;
this first signal result and the other digital signal are converted into a single-channel signal, and the single-channel signal is transmitted on a single channel to the superordinate processing unit;
the second signal result is calculated in the superordinate processing unit; and
the two signal results are compared in the superordinate processing unit.
In accordance with another refinement of the alternative method according to the present invention, an error-tolerant transmission protocol is used for the digitized signal and/or the digitized signal result during single-channel transmission to the superordinate processing unit.
The object of the present invention is achieved by an apparatus, corresponding to the inventive method, for safe evaluation of sensor signals, which has the following features:
a signal production means for diversifying the sensor signals by deriving a redundancy signal at an arbitrary point in a hitherto redundant signal processing chain directly from the original sensor signal in accordance with a prescribed processing instruction;
an analog/digital converter for digitizing original signal and redundancy signal;
a means for converting the digital original signal and redundancy signal into a single-channel signal for singular further processing;
a data transmission unit for single-channel transmission of this single-channel signal;
a superordinate processing unit having computation means for deriving dual-channel signal results in the superordinate processing unit by reversing the prescribed processing instruction; and
further computation means for monitoring original signal and redundancy signal for plausibility by reciprocal signal result comparison.
In a further preferred embodiment of the apparatus according to the present invention, two evaluation units are provided for reciprocal signal result comparison in the superordinate processing unit.
In accordance with an alternative preferred embodiment of the apparatus according to the present invention, the following further features are provided:
a first evaluation unit is arranged in the superordinate processing unit; and
a second evaluation unit is arranged in the sensor which ensures reciprocal signal result comparison using the data transmission unit;